search

csababarta / ntdsxtract

Active Directory forensic framework
http://www.ntdsxtract.com
GNU General Public License v3.0
311 stars 109 forks source link

Add ability to produce summary files of user account control attributes. #9

Open powderspecial600 opened 9 years ago

powderspecial600 commented 9 years ago

It would be nice to add a flag to be able to enable certain user account controls to be listed in a summary file. For example if an account is flagged with ACCOUNTDISABLE, we could write that username to a file. We could do the same for PWD_NOTREQD and DONT_EXPIRE_PASSWORD. This way we have an easy method of seeing who has a disabled account, a password that is not required, and a password that doesn't expire. Ideally we would produce three files one of a list of users for each control. Today I am doing this with a bunch of grep statements and it gets kinda messy.

csababarta commented 9 years ago

I will try to implement a filtering functionality with which you can filter based on the most important flags.

csababarta commented 9 years ago

Hi,

please check out the new option --uac in the latest version. Using it you can combine all the known UAC flags in order to get only the users you really want to see. You can then use the --csvoutfile option in order to get a csv file with the accounts.

Let me know if it works for you!

Regards, Csaba